Scammers using fake job ads to steal people’s identities

Excerpted from a ProPublica blog by Cezary Podkul

It has become a ubiquitous internet ad, with versions popping up everywhere from Facebook and LinkedIn to smaller sites like Jobvertise: Airport shuttle driver wanted, it says, offering a job that involves picking up passengers for 35 hours a week at an appealing weekly pay rate that works out to more than $100,000 a year.

But airports aren’t really dangling six-figure salaries for shuttle drivers amid some sudden resurgence in air travel. Instead, the ads are cybercriminals’ latest attempt to steal people’s identities and use them to commit fraud, according to recent warnings from the FBI, the Federal Trade Commission and cybersecurity firms that monitor such threats. The U.S. Secret Service, which investigates financial crimes, also confirmed that it has seen a “marked increase” in sham job ads seeking to steal people’s personal data, often with the aim of filing bogus unemployment insurance claims.

“These fraudsters, they’re like a virus. They continue to mutate,” said Haywood Talcove, chief executive of the government division of LexisNexis Risk Solutions, one of several contractors helping state and federal agencies combat identity theft.

This particular mutation is an emerging threat, Talcove and others said. The numbers are small so far, but they’re rapidly increasing. In March, LexisNexis detected around 2,900 ads touting unusually generous pay, using suspicious email domains and requiring that one verify one’s identity upfront. The total had grown to 18,400 by July, and then to 36,350 as of this month. Talcove said these figures are based on a small sample of job ads and that the real number is likely much higher.

This form of scam is surging at a moment when targets for job application fraud abound. Millions of Americans are quitting jobs and looking for new ones. An all-time high percentage of workers — 2.9% — quit their jobs in August, according to the U.S. Department of Labor. Meanwhile, huge numbers of laid-off workers are still looking for work, making for a historic churn in the labor market.

The ads reflect a tactical adjustment by cybercriminals. A massive wave of unemployment insurance fraud during the pandemic prompted authorities to heighten identity verification requirements. In most U.S. states, cybercriminals can no longer simply input stolen identity information into government websites and frequently collect unemployment insurance aid. Now, applicants whose names are used to apply for unemployment benefits often need to verify on their phones that they’re the ones seeking assistance, a process similar to two-factor authentication.

That means scammers may need help from their victims — and sometimes they go to elaborate lengths to mislead them. Some fraudsters recreate companies’ hiring websites. One fake job application site uses Spirit Airlines’ photos, text, font and color code. The phony site asks applicants to upload a copy of both sides of their driver’s license at the outset of the process and sends them an email seeking more information from a web address that resembles Spirit’s, with an extra “i” (spiiritairline.com). Spirit Airlines did not respond to requests seeking comment.

Other job scams are less elaborate and have more visible signs of inauthenticity. One fake ad for airport shuttle drivers on Facebook was posted by a woman who purported to be working at Denver International Airport. Diligent readers may have noticed that the only location linked from the woman’s Facebook profile was a Nigerian city called Owerri.

In other instances, unsolicited job offers simply land in applicants’ inboxes after they’ve uploaded their résumés to real job search sites, which scammers can access if they pose as potential employers. Jeri-Sue Barron has received a slew of emails since the start of the pandemic informing her that she was preapproved for a variety of jobs she hadn’t even applied for.

Barron, a retiree in suburban Dallas, had uploaded her résumé to several job-hunting sites in hope of finding some part-time work to supplement her Social Security income. She then received multiple job offers with nary a request for an interview. One email originated from a school in India’s Kerala state; another came from a Croatian website she’d never heard of. “They started coming in from places that were weird,” said Barron. “You almost don’t want to find out the next stage.” She ignored the offers.

As with fake unemployment claims more broadly, the fraud is being facilitated by an underground infrastructure, including online forums where cybercriminals share advice on how to perfect their techniques. A person using the handle “cleverinformation” on a U.K. forum called Carder put together a how-to video that recommends posting fake job ads using a generic job application that can be modified to collect personal data. In September, someone going by “mrdudemanguy” on another forum, known as Dread, offered this advice to a person seeking stolen identities: “Pretend to be a local business and post some job ads. When they send in their résumé, call them and ask some basic job application questions. Make them think they’ve got the job as long as they can do a background check. For the background check request they send you photos or scans of ID documents.”

For the full story, please click here.